Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

Unexpof writes "A man has been arrested by the British Police Central e-Crime Unit (PCeU), accused of stealing the usernames and passwords from players of the RuneScape MMORPG. Security experts report that this is one of the first occasions when a Brit has been apprehended for 'virtual robbery,' although incidents have happened in the past. For instance, the CEO of the sci-fi trading game EVE Online stole 200 billion 'kredits,' which he then used as a deposit on a real-world house, and in October last year a Japanese woman was arrested by police after allegedly hacking her virtual husband 'to death.'"

He hacked the logins which is pretty much equivalent to hacking an email account. The eve online thefts were all perpetuated via in-game mechanisms and since the game's terms state that all in-game items are property of the maker of the game, there was no actual IRL theft to prosecute.

It's not exactly the same as hacking someone's email account though, because if you do that you can potentially get hold of peoples bank/ebay etc accounts. I don't give a rat's arse about this or that game, and I'm a little annoyed about the idea of tax payer's money being wasted on non-crimes such as this.

It's not exactly the same as hacking someone's email account though, because if you do that you can potentially get hold of peoples bank/ebay etc accounts. I don't give a rat's arse about this or that game, and I'm a little annoyed about the idea of tax payer's money being wasted on non-crimes such as this.

Well, I assume Runescape is paid for on a monthly payment and you're actually 'renting' something that the makers of Runescape technically own (if they have a ToS similar to WoW). We discussed this in August [slashdot.org] about whether or not virtual property should be under the same law as regular property.

And really, you should be happy that your tax dollars are paying for this. The closest analogy I can think of is if you rented a moving truck and someone stole it from in front of your house and then anonymously returned it to the store at the end of your rental period. Now, you didn't get to move any of your stuff yet you were still charged for the truck. Basically you've entered into an agreement to use someone business's property in exchange for money and now a third party has not only obstructed that but prevented you from receiving use/enjoyment from your purchase. On a case by case basis, maybe not a big enough deal for $13 (or whatever Runescapes monthly payment is). On a mass scale (like this), call the authorities. The sad thing is that the emotional attachment and feelings of ownership that humans attach to accounts, items and characters are more than likely overlooked. And there's not a lot you can do about that, the law sticks to protecting things that are real and definite and measurable like your monthly payment.

Now, if Runescape was a free game and there was no credit card information at risk then I would agree that the authorities should let the players appeal to the Runescape company to increase protection of their accounts.

I'm sure I'll get mocked for this, but I did play the game for a long time as a member a few years ago. Accounts have a password, but in game, to access your bank, you also need to enter a 4-digit pin number, and it's not type-able with your keyboard, so no keylogger can get it, and the places where numbers are change with each click. Also, you can't trade items with other players in very unbalanced trades (to stop gold farming).

AP - Quebec - Another teen corpse missing fingers and eyes was found Saturday in the vicinity of Quebec's biggest internet cafe.

"We are starting to see a lot of this," said Officer Bergeron, "now that Runescape has increased security. People watch who logs into Runescape with their retna scans and fingerprint devices... at the cafe and then they lay in wait outside. When the person comes out, they beat them until they give up the password and then they take the other two things they need."

Jagex, makers of Runescape, did not return calls to their offices.

This marks the twentieth vicious slaying for Runescape items and virtual currency. An anonymous patron of the cafe said, "We've all been there. I mean, my good friend has twice the cash I do in game and I'm not denying it--I've had thoughts about how simple and quick it would be to asphyxiate him and then remove his eyeball with a pen or melon baller... and you really just need one index finger for the fingerprints. And then just log in with his retna and finger kept fresh in my refrigerator. I wouldn't be a weirdo about it, I've seen those shady guys with the eye/finger keychains. It's so simple and all you're doing is stealing some stuff off their account... I'm honestly shocked more gamers aren't doing it."

The recent victim's mother said she knew that her son was involved with Runescape but that she wasn't aware of the risks associated with such a game. After identifying the eyeless corpse of her son, she spoke out against online gaming and implored regulators to think of the children and put a stop to all online gaming. She ended her statement with "Before parents make that first $6 payment for their kids... they should realize what they are condemning them to."

The funny thing is that Jagex has experimented with fingerprint scanners and has suggested ideas for players to get some sort of physical device (a "dongle" or other such item) that would make a more "secure" connection... and to benefit players with some in-game features like increased bank space and other such stuff if those players buy those security features.

I don't know about the homicides that may or may not happen if players get incredibly jealous about another player, but that is something completel

5$/month for me:DEven though Jagex has gone through extensive measures to limit the ability of hackers to harm their prey, there is still a plague of hacks from merchanting clans and account sellers that specifically attack those people who do not yet have a bank pin.

The idea is that some private clan performs a buyout on some item, then when the item crashes, the inside members hack other accounts, then use the hacked player to buy the crashing items. Typically, the hacker then drops the crashing items on

There are dozens of ways to transfer money between accounts if that is your goal. The Bounty Hunter game was one of the most effective, and there have been problems with the Party Room and other places where even with the "balanced trade" you can still transfer huge amounts of money.

There have also been malicious folks who log into an account and then clean out the bank (dumping it into the party room or elsewhere, or simply leaving it "on the floor" in the bank) and then log out. That would be akin to th

For all the press this game is getting I'm pretty sure they will resurrect the character and he can go on with his life, maybe if their nice they'll give him a couple of virtual bucks to buy a new virtual life which he could really use. I personally think proposing a jail sentence is retarded, giving this kind of thing such a 'real world' significance just provides a false sense of security to people who want to cry to law enforcement every time someone steps on their virtual property. Next thing you know

I don't give a rat's arse about this or that game, and I'm a little annoyed about the idea of tax payer's money being wasted on non-crimes such as this.

Better to prosecute them for a crime that doesn't concern you before they move onto crimes that do target you. Stop them while they're still phishing Runescape accounts, instead of e-mails, bank accounts, or credit cards.

I'm sure you will appreciate that taxpayer money is used to pursue criminal charges when someone steals your [insert thing that nobody else but you cases about here].

It is pretty close to the same thing. What happened was that this guy who was arrested made a Phishing website that looked and behaved just like the real thing, and required the "user" to enter the username and password in order to enter. Enough individuals entered to "correct" information that they were able to use those username/password combinations to "hack" into the real user accounts on the official Jagex servers.

This is no different than somebody setting up a website that looks very similar to the y

Uhm, it was not the CEO for CCP (makers of Eve Online) who stole isk (not "kredits") to buy a house. It was a CEO of a player-run banking corporation. Ingame Eve corporations are like clans, so there's a BIG difference.

this needs to be moded up. EVE's 'dollar' is the isk and the guilds are 'corporations' in EVE. CCP is the maker of the game EVE... so it's entirely likely the poster might have mistaken the EVE online situation.

More over, CCP hired a nobel prise winner for economics to manage the market in the EVE online game so I find the idea that the CEO of CCP somehow stealing from his company and buying a house a little suspect, especially given the lack of links to prove that.

The reference to buying a house comes from the fact that Ricdic, the CEO of said (in game) bank that was stolen from, converted the isk he stole to real money via Real Money Trading. This part, whilst not hacking, was against the EULA of the game, and got his account banned.

His stated reason for going the RMT route was a sick child, and a mortgage debt...

I think it's also worth emphasising that it was only the sale of in-game currency for cash which got Ricdic's account banned, not the actual theft. If he had kept the cash in-game, he wouldn't have been subject to sanctions from CCP at all.

Ricdic has now been thrown out of the game as trading in-game cash for real money is against Eve Online's terms and conditions.

The rules governing play within Eve would not have sanctioned Ricdic if he had simply stolen the cash and used it in the game, nor if he had bought kredits with real dollars.

Of course the nature of this particular theft doesn't really relate to the RuneScape account theft since it occurred within the rules of the game in question; describing it as "similar illegal activity" is misleading at best.

[I]n October last year a Japanese woman was arrested by police after allegedly hacking her virtual husband "to death".

It sounds like she performed some kind of violent action, but in truth she just logged into his account (using info from when they were in a relationship) and destroyed his character. This got billed as "virtual murder" a lot back when the story broke to make it more salacious, but it's just the equivalent of logging into someone's webmail who made the mistake of telling you their password and deleting the entire history and address book.

And you can't really even call it stealing. Other players GAVE their isk to the banking corporation with the understanding that they could take it back with interest later. Since there is no in-game way to enforce this sort of relationship, doing this with people you have no reason to trust is just like throwing your money away.

someone needs to get a clue. stealing and using or selling a users credentials is not a virtual theft. virtual theft is stealing the users stuff inside the game. stealing thier credentials to get into the game is the same as stealing their credentials for thier bank account or for their computer. Using said stolen credentials amounts to unlawful access at the very least.

Why do they steal the credentials? So they can access the virtual content and either strip the account dry of its resources or to sell the account (which is all the virtual characters and resources) to another person. So really, you are just nitpicking.

No, really, stealing the items inside the game is not illegal in the real world because there are no laws pertaining to it.

It has still to be determined whether virtual items or currency has and real world value by the government. I hope it stays that way too, because once the gov decides it has real world value they will decide to tax it in some manner. Outside of the majority of these games the virtual items and currency cannot be legally traded due to the terms of the EULA. Doing so is normally a serio

To be fair, it is not the GP's fault but the submitter and article authors fault.

Both use the word 'theft' and did so in the context of crimes. That fully brings the word into legal use, and legally theft is very specifically (nitpicky) defined. You can't avoid nitpicking when it comes to legal terms, since that is what they are by definition.

So no, taking someones credentials is not theft as defined by the law.

There is no "CEO" of Eve Online. Eve Online is a game produced by CCP of Iceland.

There ARE Virtual CEO's of Virtual corporations within the Space-based MMO EVE Online.

I am also not aware of any corp CEO that has used EVE-O ISK to buy a real world house. Somehow I doubt any bank would accept a virtual money as collateral on a real house. Of course, If a private party was that foolish, then hey, more power to the corp CEO. Nevertheless that sounds like a fake story.

Actually, that story happened, at least it was wildly [no, not misspelled, though other words are] reported at the time. It was a huge scam with a PLAYER run bank doing something nasty. I would give more details, but that would mean having to give a rats arse about Eve.

But yeah, the summary makes it out like it was a CEO of the company behind Eve that did this. I was with that company I would sue Slashdot for slander in England (sure a brit read it).

Oh, I knew about the EVE Bank scandal, You couldn't play EVE and NOT know about it. I was just questioning the veracity of the report that the CEO in question actually used the virtual funds to buy a real house.

Although I suppose (as another has postulated) that he could have sold the funds for real money, but that seems unlikely as well, given the high-profile nature of the scam, I suspect that CCP was watching his account closely for large ISK transfers. Although back then I know that they weren't as vi

Alright, the first part of the article deals with actual crime, but the support examples of "crime" are a civil matter. The way he went about capturing users data is illegal, "stealing" in game currency is a policy for the company to deal with. The last example is just stupid, if true (citation needed).

Security experts report that this is one of the first occasions when a Brit has been apprehended for "virtual robbery", although incidents have happened in the past. For instance, the CEO of the sci-fi trading game Eve Online stole 200 billion "kredits"

That's completely different. The "theft" of the Eve credits was entirely in-game - arresting someone for that would be like bringing a case for murder against someone for in-game killing. The case in this article is about the theft (or more likely I should think either "obtaining services by deception" or "obtaining a pecuniary advantage by deception" - both crimes under the Theft Act but not actually theft themselves) of actual game accounts.

They didn't get rid of it, they just changed it a lot. No unbalanced trading, and no control over what you win in a PvP fight (at least, that's what I understood of it when they explained it, but I never played it PvP in the first place).

Yes, this is ordinary robbery, but carried out on a computer. Virtual robbery is when you steal items off a player character through an approved game mechanism, which is not an illegal act. And in other non-news, slashdot editors don't edit.

"in October last year a Japanese woman was arrested by police after allegedly hacking her virtual husband "to death""

Ok, let's get this corrected. There was no arrest for virtual murder. Repeat: There was no arrest for virtual murder. The woman was arrested for hacking into someone else's account. What she did in game is irrelevant and has just been repeated and twisted over and over for the sake of a sensationalistic "news" story.

Absolutely horrible summary but assuming that it's at least correct in saying that he stole login details for this online service then it's right to say he broke the law in regards to gaining unauthorised access to computer systems which exists in many different forms all throughout the world but would most likely be treated in the same way. I don't see why posters here don't seem understand that. Seeing as this appears to be in UK, the Computer Misuse Act states:

1:1) A person is guilty of an offence if:
a) he causes a computer to perform any function with intent to secure access to any program or data held in a computer;
b) the access he intends to secure is unauthorized; and
c) he knows at the time when he causes the computer to perform the function that this is the case.

While I'm sure this guy was a real douche nozzle, I'd like to see people who steal real assets go to jail before the people who steal fake assets. International bankers rather than basement dwellers, ok?

Doesn't sound like robbery, unless the usernames were taken. If that is the case, how do these users even know their usernames anymore? "I'd like to report a stolen username, but since it was stolen, I can't tell you what the username was. If I knew it, it I wouldn't be reporting it as stolen, now would I?"

That doesn't make any sense. People play the games to have fun and they pay the software engineers to produce the virtual environments. It's a perfectly legitimate transaction. The producers of the software don't make any money when their users get scammed so it is in their interest to explicitly create an environment that DOESN'T enable theft.

You're having a knee-jerk reaction. How did you lose the gold after buying it, anyway? You would have had to give out your username and password. You shouldn't have t

Is she going to be given the choice of:1. Virtual lethal injection. (virus)2. Virtual firing squad. (One of those FPS games seems relevent).3. Virtual hanging. (Obama's good at this. Just ask any banker)4. Electricution. (Throw her computer into the bathtub)5. Virtual stoning. (tetris)6. Bore them to death . (Make them read the entire health care bills, from both houses)

This case must have been really old or something. For years RS has had a trade limit and bank PIN that you enter with the mouse. So if you steal someone's account, you can't get into their bank to get any of their items. You also can't offload them onto another account because the 15 minute trade limit is around 1/100th the cost of anything remotely worth stealing. There is literally no way to move expensive items to another account without paying what they're worth to the owner. So he clearly didn't "

This sort of thing is happening more often these days. It is a sign that virtual worlds are overlapping the real world and is only going to get more prolific as more and more people spend their lifes in virtual worlds and virtual worlds become more indistinguishable from the real world. Next thing you know you'll be arrested as a war criminal for that mass-massacre you carried out in Battlefield 2. Seriously, it's almost as if the worlds created by Neal Stephenson or William Gibson are slowly coming true

Stealing virtual items in a MMORPG is not a crime, and at most a violation of the terms of service.

Stealing identities by way of online passwords is not a virtual crime, it's a very normal, plain computer crime.

That is, of course, why real-world police are making the real-world arrest of a real-world person that is going to a real-world prison.

This is a crime that is being prosecuted for tampering with somebody else's computer systems without authorization, and having committed fraud (another real-world crime) to obtain the usernames and passwords to gain access to these accounts.

...the people were stealing x-box accounts?(not really a crime)...and then sold them/returned the "gold membership" for a refund?(definitely grounds for theft.)
what would the repercussions be? I would think it would e the same as stealing someone else's videogame and returning the game back to best buy or something.
am i on the wrong path or what?